advapi32: Fix undocumented behaviour in ReqQueryValueEx when 'count' and 'type' point to the same address.

These registries are present in a fresh Windows installation, but they
cause problems with native IE, so let's handle them as we do with IE
version key.

Out-of-memory check is performed by NdrAllocate and so isn't required to 
be done in the unmarshalling functions.

Tests show that NdrPointerFree (and hence NdrFree) don't check whether 
the memory was allocated with NdrAllocate before freeing it. This makes 
sense as servers don't need to use NdrAllocate to allocate memory being 
returned and so this commit caused that memory to be leaked.

NdrAllocate hasn't been changed as the tests show it is correct and it 
appears that the memory list is used to implement the RpcSs memory model.

Add comments to justify why this is the only check that is needed.

These are supposed to point to the original buffer when the types were 
unmarshalled.

Revert "rpcrt4: Try to free every non-stack pointer in PointerFree now that NdrFree does the sanity checking for us.".

This reverts commit 6db648302ce43f625a073426a35a6f40b7869d8b.

Tests show the assumptions in a commit that this commit depends on are 
not valid.